[DEV|APPv14] CIQ / HTC & Google Checkin / HTC loggers / Tell HTC Info & Removal

Search This thread

smw6180

Senior Member
Oct 31, 2007
6,078
4,841
Bear, DE
Yep but im not saying much more on here :) this time im not going to have a sort of response, this is going to be logs, process info, how stuff works, full nuts and bolts. Might take a bit longer to do but im goign full out this time. Also goign to show more than just the e3d. got my 4g ruued and going too for some extra proof

Gotcha. Have fun. :)
 

TrevE

Retired Recognized Developer
Apr 27, 2007
2,031
3,659
androidsecuritytest.com
I also need the communities help with this

Third-Party Software:

It is also important to note that the phones we build are a compilation of not only software and services from HTC, but also from third parties. These third-party applications and services, such as Carrier IQ (CIQ) and Google Check-in, serve to further improve the customer experience and have their own privacy policies. We encourage consumers to understand the specific policies of any application or service that is enabled on their device.

Carrier IQ im assuming is from sprint because of the iqprofile.pro file. Can anyone find any documentation on sprints site or our phone on CIQ? If not maybe its time to bug them?
 

smw6180

Senior Member
Oct 31, 2007
6,078
4,841
Bear, DE
I also need the communities help with this



Carrier IQ im assuming is from sprint because of the iqprofile.pro file. Can anyone find any documentation on sprints site or our phone on CIQ? If not maybe its time to bug them?

Start here Trev, I'm still looking:

http://xdaforums.com/showpost.php?p=11763089&postcount=3
Carrier IQ as a platform is designed to collect "metrics" at any scale. What I found it to hook into is far beyond the scope of anything a carrier needs - or should want - to be collecting. Carrier IQ sits in the middle of, and "checks" the data of, SMS and MMS messages. It listens for and receives every battery change notifications. It hooks into every web page you view, and every XML file your device reads. It receives every press of the touch screen. It 'sees' what you type on the physical keyboard. It reads every number you press in the dialer. It can track which applications you use, what 'type' they are, how often, and for how long. It hooks into data sent and received.
 
  • Like
Reactions: TrevE

smw6180

Senior Member
Oct 31, 2007
6,078
4,841
Bear, DE
Yeah ive seen that, see how they have a UI? Thats what i think we should have at the VERY least, but that does not exist on our copy.

Agreed.

Here's another link for you:
http://www.sprintusers.com/forum/showthread.php?t=221959

Not really finding much out there. Seems to be a fairly well-kept secret. Most of what I'm finding so far links right back here ;)
Edit:
One more link...you might have seen this one.

http://www.droidgamers.com/index.ph...-devices/2196-how-htc-watches-your-every-move

This is about all I'm finding. Everything else either points back here or is corporate smokescreen BS...and there's a very LARGE lack of information from Sprint on the issue, which I suppose should be expected.
 
Last edited:

guitardoc64

Senior Member
Sep 26, 2007
2,120
556
Lake Charles,LA
OnePlus 7 Pro
OnePlus 8T
This is about all I'm finding. Everything else either points back here or is corporate smokescreen BS...and there's a very LARGE lack of information from Sprint on the issue, which I suppose should be expected.

Yeah, Sprint wants this on their phones. I have an reliable source on that. They can at any time pull logs without you even being aware. I can't say more on this ATM, probably said too much anyway but it needs to be known.
 
  • Like
Reactions: fawkes21

TrevE

Retired Recognized Developer
Apr 27, 2007
2,031
3,659
androidsecuritytest.com
Hey guys, I will be releasing the first part of this app shortly. It will let us start to interface with HTC logging, and prove exactly what is running when you "opt in/ opt out"

K2DSX.png
 

TrevE

Retired Recognized Developer
Apr 27, 2007
2,031
3,659
androidsecuritytest.com
Logging Test App v14

Logging Test App v14


Attached to this post is my app that should interface with these logging services. Lets start by saying I HATE JAVA. Im an IT guy so i know my way around a few languages but im not the best so deal with uglyness. It is a work in progress and I will be adding more later.

This app has started to turn into a full security suite. It can be used to verify what logging is being done on your phone and where data is going to. It will assist you in manually removing parts you do not running (see post#1), or you can go pro for automatic everything (and support me)

You may use this version of the app anywhere and redistribute it. I have only tested on e3d, but it should work everywhere. I have heard it working on thunderbolt and e4g so far. Just make sure to give me credit if you bundle this in somewhere and do not modify it. Also please do not distribute the market key-- Its only $1.
tFcVz.png


  • Check CIQ files (Root Only)- Sees if CIQ exists in your system
  • Check Google Usage Logs(Root Only)- Checks for logs in /data/system/usagestats
  • Check HTC Usage Logs (Root Only)- Checks for logs in /data/system/appusagestats
  • Check Devlog (Root Only) - Checks /devlog partition, written out by htc_ebdlogd
  • Check Dropbox Logs(Root Only)- Checks for logs in /data/system/dropbox
  • Check UserBehavior DB(Root Only)- Reads user Behavior monitoring database
  • AppUsage UI - See app usage logs in UI
  • CIQ APP UI - Attempts to open all known CIQ Activities
  • Start HTCLoggers - Start HTC Logging Activitie

Services: You first must run a list to get a dump of all active services. Anything running on your phone will return to the spinner. Select a service and press the button again to get a dump of the service.

  • HTC Checkin DB (Root Only)- Shows what info you are sending to htc when checking in automatically
  • Google Checkin DB (Root Only)- Shows what triggers Google checking in automatically
  • HTC Report Agent - Shows what triggers HTC Reporting.
  • Common Commands- Network Diagnostic tools to see IP address/routes/outbound connections/automatically control port dialog (see below)
  • Port Control- Lets you input manual commands (or use above spinner) to local ports on your machines. Unix Domain Sockets will be enabled next

  • Read Cookies (Root Only)- Reads Sticky "Location Cookies" - clearing all data in browser does not wipe these
  • Wipe Cookies (Root Only)- Wipes Location Cookies. (pro not required)
  • Flash Settings Set local storage to "Only from sites I visit" and disable "Peer-Assisted Networking"
  • Convert to HTTPs (Root Only)- Updates stock top 500 db with https where possible. See pro options
  • Change Firefox Search to HTTPS (Root Only)- Changes default search to use HTTPs
  • Check/Set IPv6 Privacy(Root Only) - Sets if your MAC address is used as part of your IPv6 address. Dialog explains more


Starting with version 3, i will be supporting cleanup/removal from many devices. The checking part of the app will always be free here but because of the time it took me to universally code the removal and because we already have documented 100000 ways to do it yourself (see post 1) I have decided to put the key to unlock removal features on any device on the market. It should be listed under package com.treve.loggingkey Its called Logging TestApp Pro Key. Just install the apk linked here first, get the key from market (99 cents, hardly much to support dev in progress) and install, then go back to original app and enjoy pro. You will now have access to the menu items to patch logging on the device.


Version 5 of pro adds in an option to convert webdb to https. What this does is goes through the default websites and resets the address to the https site. What I hope to end up getting is something like the EFF's HTTPS Everywhere until then this is the "ghetto way"

To use https convert option:
  • Set homepage to https://www.google.com/m
  • Kill browser with a taskilller, open logging test app
  • press menu, go to convert to https
  • open browser and start typing in some letters like facebook or wiki or google or bank you should see https infront of them.


It has been tested on evo4g, evo3d, and thunderbolt so far. I will be supporting more devices if a device you have does not work let me know.


Screenshots/How to read output

To tell if you are spyware/logging free, none of these buttons should do much of anything. For example:
  • if you check usage stats/dropbox/devlog, you should see no files or 0k for anything listed.
  • if you start the usage service intent, you should see no apps listed. All other intents should not start.
  • You should not be able to connect to port 65511.


Screenshots of a "fail condition" Shows on stock rom regardless of tell HTC or location setting logging is enabled and running, proving HTCs statement wrong, wasting resources, io, memory, bandwidth the works - http://xdaforums.com/showpost.php?p=17614324&postcount=114


Screenshots of a "pass condition". Shows all logs not writing and intents disabled (only possible after modifications, i cannot find a stock setting that will do this. see post1) - http://xdaforums.com/showpost.php?p=17614542&postcount=116


Let me know how this works out, more goodies will keep on flowing :) It does use permission internet, its required to open sockets.
 

Attachments

  • TrevE_Logging_TestApp_v4.apk
    22.5 KB · Views: 18,862
  • TrevE_Logging_TestApp_v5.apk
    24 KB · Views: 3,830
  • TrevE_Logging_TestApp_v5.1.apk
    26.1 KB · Views: 4,011
  • TrevE_Logging_TestApp_v6.apk
    29.8 KB · Views: 10,459
  • TrevE_Logging_TestApp_v7.apk
    49.2 KB · Views: 198,142
  • TrevE_Logging_TestApp_v8.apk
    56.1 KB · Views: 12,554
  • TrevE_Logging_TestApp_v9.apk
    57.2 KB · Views: 8,696
  • TrevE_Logging_TestApp_v10.apk
    58.8 KB · Views: 1,255
  • TrevE_LoggingTestApp_v11.apk
    76.9 KB · Views: 2,442
  • TrevE_LoggingTestApp_V12.apk
    112.3 KB · Views: 1,978
  • TrevE_LoggingTestApp_V13.apk
    125.3 KB · Views: 7,884
  • TrevE_LoggingTestApp_V14.apk
    137.2 KB · Views: 24,313
Last edited:

kittykat858

Senior Member
Mar 26, 2011
1,708
5,830
Attached to this post is my app that should interface with these logging services. It is a work in progress and I will be adding more later. Functions that check directories will require root (other users dont have access) but opening interfaces and ports for communication should work regardless. I will be putting in more stuff as i go to communicate with their logging, proving what it can do. Some people may already know the direction this is going :)


I have put this out and will be continuing work on it MAINLY in response to this statements below so everyone can see how untrue this is themselves. Disable tell HTC and watch usage stat logs build, connect to htc logger service, whatever. its ALL still running and logging. http://www.xda-developers.com/android/htc-responds-once-again/






You may use this version of the app anywhere and redistribute it. I have only tested on e3d, but it should work everywhere. Just make sure to give me credit if you bundle this in somewhere.
DwsM4.png



HTC Checkin:
[/B]Check Usage Logs (Root Only)- Checks for logs in /data/system/appusagestats
Read Checkin DB- Shows what info you are sending to htc when checking in automatically (disabled while i work on it)

Google Checkin
Check Usage Logs(Root Only)- Checks for logs in /data/system/usagestats
Check Dropbox Logs(Root Only)- Checks for logs in /data/system/dropbox
Start Usage Intent - See app usage logs in UI

Carrier IQ
Open Port 2479 - Sends data to port 2479
Start Intent - Opens GUI test activity

HTC Loggers
Open Port 65511 - Query for list of active HTC logging ports
Start Intent - Start HTC Logging Intent


To tell if you are spyware free, none of these buttons should do much of anything. For example if check htc usage stats, you should always see 0k for any file listed. if you start the usage service intent, you should see nothing. You should not be able to start htc logger intent or connect to port 65511.


Let me know how this works out, next version will have way more goodies in it.

gonna 'test' this app
 

malicon

Senior Member
Aug 2, 2011
368
71
NorCal
great work on this, thanks so much for your dedication.

tried the app and it works great. I'm on xron 4.5 and both carrier iq and htc loggers are closed, but both htc and google checkin are logging. going to chmod those directories and let the devs know.
 

TrevE

Retired Recognized Developer
Apr 27, 2007
2,031
3,659
androidsecuritytest.com
So everyones clear, attached are some of my screenshots of a stock rom with tell HTC disabled. You can see logs are growing, ports are opened, etc, this would mean that tell HTC has no effect on if logging is done or not. Next post will be from synergy with everything disabled so you can clearly see a pass vs this fail.
 

Attachments

  • stockdropbox.jpg
    stockdropbox.jpg
    39.2 KB · Views: 3,996
  • stockusage.jpg
    stockusage.jpg
    31.2 KB · Views: 4,794
  • usagestats.jpg
    usagestats.jpg
    28.2 KB · Views: 5,030
  • stockports.jpg
    stockports.jpg
    31.4 KB · Views: 3,506
Last edited:
  • Like
Reactions: NexuGsx

guitardoc64

Senior Member
Sep 26, 2007
2,120
556
Lake Charles,LA
OnePlus 7 Pro
OnePlus 8T
Thanks for the cool tool TrevE! Apparently, I have managed to get all but the Google logging turned off in a stock ROM. I followed your guide, flashed Freeza's no iq kernel and removed the apk's. The only result I got was from the Google stuff. All the tests for the HTC and carrier iq show unabe to start. Thanks for helping me confirm that my tweaks did the job. I guess I'll have to re-engineer what I've done so I can help others.
:)

Sent from my EVO 3D with Tapatalk pro!
 
  • Like
Reactions: TrevE

TrevE

Retired Recognized Developer
Apr 27, 2007
2,031
3,659
androidsecuritytest.com
Here is what i would consider a pass. The intents do not start becides usage stats which displays nothing, and all logs are 0.

If we could really opt out, i would expect a stock rom from HTC to look exactly like below
 

Attachments

  • synergyusagestats.jpg
    synergyusagestats.jpg
    7.8 KB · Views: 2,656
  • synergylogport.jpg
    synergylogport.jpg
    26.2 KB · Views: 3,508
  • synergydropbox.jpg
    synergydropbox.jpg
    27.2 KB · Views: 4,728
  • synergyhtcappusage.jpg
    synergyhtcappusage.jpg
    28.6 KB · Views: 3,374
Last edited:

2fast4u88

Senior Member
Nov 6, 2010
244
67
I happened to come across this doing a bit of research while playing with a rom. Seen the whole thing so started digging in the files as I noticed the logging. But so far all this stuff is in the gingerbread update for the uscc merge also. Only thing I did notice was a few I think ciq things set to false instead of true.

I believe it was actually two spots. How ever I am not in depth as far as this thread is involved I just did some of the edits so far. But if you need any info I can see if I can pull it out. Otherwise just throwing it out there.
 

SteelH

Senior Member
Jun 12, 2010
3,120
2,965
Here is what i would consider a pass. The intents do not start becides usage stats which displays nothing, and all logs are 0.

If we could really opt out, i would expect a stock rom from HTC to look exactly like below

Did you take screenshots of SteelROM ? :) LOL, J/K, but that's the same result you'll see on SteelROM thanks to you!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 406
    Logging Test App v14

    Logging Test App v14


    Attached to this post is my app that should interface with these logging services. Lets start by saying I HATE JAVA. Im an IT guy so i know my way around a few languages but im not the best so deal with uglyness. It is a work in progress and I will be adding more later.

    This app has started to turn into a full security suite. It can be used to verify what logging is being done on your phone and where data is going to. It will assist you in manually removing parts you do not running (see post#1), or you can go pro for automatic everything (and support me)

    You may use this version of the app anywhere and redistribute it. I have only tested on e3d, but it should work everywhere. I have heard it working on thunderbolt and e4g so far. Just make sure to give me credit if you bundle this in somewhere and do not modify it. Also please do not distribute the market key-- Its only $1.
    tFcVz.png


    • Check CIQ files (Root Only)- Sees if CIQ exists in your system
    • Check Google Usage Logs(Root Only)- Checks for logs in /data/system/usagestats
    • Check HTC Usage Logs (Root Only)- Checks for logs in /data/system/appusagestats
    • Check Devlog (Root Only) - Checks /devlog partition, written out by htc_ebdlogd
    • Check Dropbox Logs(Root Only)- Checks for logs in /data/system/dropbox
    • Check UserBehavior DB(Root Only)- Reads user Behavior monitoring database
    • AppUsage UI - See app usage logs in UI
    • CIQ APP UI - Attempts to open all known CIQ Activities
    • Start HTCLoggers - Start HTC Logging Activitie

    Services: You first must run a list to get a dump of all active services. Anything running on your phone will return to the spinner. Select a service and press the button again to get a dump of the service.

    • HTC Checkin DB (Root Only)- Shows what info you are sending to htc when checking in automatically
    • Google Checkin DB (Root Only)- Shows what triggers Google checking in automatically
    • HTC Report Agent - Shows what triggers HTC Reporting.
    • Common Commands- Network Diagnostic tools to see IP address/routes/outbound connections/automatically control port dialog (see below)
    • Port Control- Lets you input manual commands (or use above spinner) to local ports on your machines. Unix Domain Sockets will be enabled next

    • Read Cookies (Root Only)- Reads Sticky "Location Cookies" - clearing all data in browser does not wipe these
    • Wipe Cookies (Root Only)- Wipes Location Cookies. (pro not required)
    • Flash Settings Set local storage to "Only from sites I visit" and disable "Peer-Assisted Networking"
    • Convert to HTTPs (Root Only)- Updates stock top 500 db with https where possible. See pro options
    • Change Firefox Search to HTTPS (Root Only)- Changes default search to use HTTPs
    • Check/Set IPv6 Privacy(Root Only) - Sets if your MAC address is used as part of your IPv6 address. Dialog explains more


    Starting with version 3, i will be supporting cleanup/removal from many devices. The checking part of the app will always be free here but because of the time it took me to universally code the removal and because we already have documented 100000 ways to do it yourself (see post 1) I have decided to put the key to unlock removal features on any device on the market. It should be listed under package com.treve.loggingkey Its called Logging TestApp Pro Key. Just install the apk linked here first, get the key from market (99 cents, hardly much to support dev in progress) and install, then go back to original app and enjoy pro. You will now have access to the menu items to patch logging on the device.


    Version 5 of pro adds in an option to convert webdb to https. What this does is goes through the default websites and resets the address to the https site. What I hope to end up getting is something like the EFF's HTTPS Everywhere until then this is the "ghetto way"

    To use https convert option:
    • Set homepage to https://www.google.com/m
    • Kill browser with a taskilller, open logging test app
    • press menu, go to convert to https
    • open browser and start typing in some letters like facebook or wiki or google or bank you should see https infront of them.


    It has been tested on evo4g, evo3d, and thunderbolt so far. I will be supporting more devices if a device you have does not work let me know.


    Screenshots/How to read output

    To tell if you are spyware/logging free, none of these buttons should do much of anything. For example:
    • if you check usage stats/dropbox/devlog, you should see no files or 0k for anything listed.
    • if you start the usage service intent, you should see no apps listed. All other intents should not start.
    • You should not be able to connect to port 65511.


    Screenshots of a "fail condition" Shows on stock rom regardless of tell HTC or location setting logging is enabled and running, proving HTCs statement wrong, wasting resources, io, memory, bandwidth the works - http://xdaforums.com/showpost.php?p=17614324&postcount=114


    Screenshots of a "pass condition". Shows all logs not writing and intents disabled (only possible after modifications, i cannot find a stock setting that will do this. see post1) - http://xdaforums.com/showpost.php?p=17614542&postcount=116


    Let me know how this works out, more goodies will keep on flowing :) It does use permission internet, its required to open sockets.
    236
    [DEV|APPv14] CIQ / HTC & Google Checkin / HTC loggers / Tell HTC Info & Removal

    ********LOGGING REVEAL***********


    Over the past few weeks there has been alot about these "spyware" services running on our phones. I'm looking for dev input/a single place to document this all. I would also love for HTC to show us the real off switches for everything as they seem to make a big point about "opting out" lately - http://www.xda-developers.com/android/htcs-statement-regarding-ciq-data-collection/ This is all obviously more than just tell HTC crash reporting.

    The only way I have found to "opt-out" is to make changes below. HARDLY an on/off switch. You can see my analysis of stock logs getting written and processes running even though i "opted out" of everything officially possible here, here , and here



    Other devs, please chime in with your findings I also have a more non technical writeup, a poll and visio diagram up in general if you just want a quick and dirty picture of whats going on here



    3 reasons I think this is important:
    1- Where did I "opt-in" to this? It would be entirely one thing if it was like location, where an agree message pops up, but as for most of these I havent seen anything of the sorts. I would not care in the least if it was apparent.

    2- Why does htc/sprint/google whoever need to waste my mobile data (goes through my airave, so its my bandwidth) and CPU cycles/battery logging?

    3- Who the hell is getting my data?



    Below are the services, and i believe what goes to what.

    Google Checkin - /system/app/GoogleServicesFramework.apk. reports to https://android.clients.google.com/checkin see analysis here
    -Dropbox Services- I had 500+ files in it including full logcat/dmesg etc. Synced on google checkin.
    -App Usage Stats- what apps you use, install, uninstall time used uploaded with dropbox

    CIQ
    HTC/Sprint, not sure whose responsible for this. User Behavior Logging Service may be related
    -You can see what info the app seems capable of sending here hidden test functions detailed here


    Tell HTC - Tell HTC reports App crashes to HTC automatically. Even if you shut this off in htcstetupwizard it still runs and logs data.


    HTC Loggers - Seems to log certain kernel events. Has a hidden UI See http://xdaforums.com/showpost.php?p=17270348&postcount=44


    HTC Checkin - sends recovery logs (real cute), app usage stats, dmesg, mobile data usage etc. See here

    -HTC App Usage Stats. I believe these get get sent out when you "checkin"

    HTC App Usage Stats is triggered on the following:
    Code:
    1 = ("com.htc.feedback", "feedback_usageOpt")
    2 = ("com.android.browser", "user_action")
    3 = ("com.android.htccontacts", "contact_type")
    4 = ("com.android.htccontacts", "group_info")
    5 = ("com.android.mms", "message_send")
    6 = ("com.android.mms", "message_receive")
    7 = ("com.android.mms", "message_count")
    8 = ("com.android.phone", "user_action")
    9 = ("com.android.phone", "settings_quietRing")
    10 = ("com.android.phone", "settings_pocketMode")
    11 = ("com.android.phone", "settings_flipForSpeaker")
    12 = ("com.android.phone", "edit_b4_call")
    13 = ("com.futuredial", "transfer_data")
    14 = ("com.htc.album", "storage")
    15 = ("com.htc.android.htcime", "press_duration")
    16 = ("com.htc.android.htcime", "UDB_words")
    17 = ("com.htc.android.htcime", "special_correction")
    18 = ("com.htc.android.htcime", "WCL_cnt")
    19 = ("com.htc.android.htcime", "duration_SIP")
    20 = ("com.htc.android.htcime", "lang_key")
    21 = ("com.htc.android.htcime", "voice_key")
    22 = ("com.htc.android.htcime", "set_CIME")
    23 = ("com.htc.android.htcime", "duration_SIP")
    24 = ("com.htc.android.htcime", "user_action")
    25 = ("com.htc.android.htcime", "waiting_time")
    26 = ("com.htc.android.htcime", "fuzzy_pinYin")
    27 = ("com.htc.android.htcsetupwizard", "is_sysTimeChanged")
    28 = ("com.htc.android.htcsetupwizard", "feedback_usageOpt")
    29 = ("com.htc.android.mail", "mail_count")
    30 = ("com.htc.android.mail", "update_schedule")
    31 = ("com.htc.android.mail", "default_mailsize")
    32 = ("com.htc.android.mail", "widget_clickcount")
    33 = ("com.htc.android.mail", "EAS_success")
    34 = ("com.htc.launcher", "layout")
    35 = ("com.htc.launcher", "scene")
    36 = ("com.htc.launcher", "user_action")
    37 = ("com.htc.launcher", "app_launch")
    38 = ("com.htc.launcher", "leap_view")
    39 = ("com.htc.launcher", "skin_picker")
    40 = ("com.htc.music", "storage")
    41 = ("device_status", "battery")
    42 = ("device_status", "battery_low")
    43 = ("device_status", "bluetooth")
    44 = ("download_manager", "download")
    45 = ("system_server", "application_launch")
    46 = ("system_server", "activity_launch_history")
    47 = ("system_server", "MRU_click")
    48 = ("system_server", "activity_tabCount")
    49 = ("system_server", "tab_index")
    50 = ("system_server", "app_uninstalled")
    51 = ("system_server", "launcher_downloaded")



    Testing / Removal App

    I have also written an app to check these services easily. See all details for that here - http://xdaforums.com/showpost.php?p=17612559&postcount=110


    Part 1 - Framework.jar
    Part 2 - Services.jar
    Part 3 - Ramdisk/Kernel Source Misc Files
    62
    Framework.jar


    /com/htc/utils/ulog/ULog.smali- this stops logging services from starting (removing init lines)

    .method public static log(Lcom/htc/utils/ulog/ULogData;)V
    Code:
        sget-object v1, Lcom/htc/utils/ulog/ULog;->sUserBehaviorLoggingService:Lcom/htc/utils/ulog/IUserBehaviorLoggingService;
    
        if-nez v1, :cond_2
    
      [B]ORIGINAL LINE- [/B] invoke-static {}, Lcom/htc/utils/ulog/ULog;->init()V
      [B]MODDED LINE- [/B] goto :goto_0

    .method private static log(Ljava/lang/String;)V
    Code:
        :cond_1
        sget-object v1, Lcom/htc/utils/ulog/ULog;->sUserBehaviorLoggingService:Lcom/htc/utils/ulog/IUserBehaviorLoggingService;
    
        if-nez v1, :cond_2
    
        [B]ORIGINAL LINE- [/B]  invoke-static {}, Lcom/htc/utils/ulog/ULog;->init()V
      [B]MODDED LINE- [/B] goto :goto_0
    .method public static logStat(Lcom/htc/utils/ulog/ULogStat;)V
    Code:
        sget-object v1, Lcom/htc/utils/ulog/ULog;->sUserBehaviorLoggingService:Lcom/htc/utils/ulog/IUserBehaviorLoggingService;
    
        if-nez v1, :cond_2
    
       [B]ORIGINAL LINE- [/B] invoke-static {}, Lcom/htc/utils/ulog/ULog;->init()V
      [B]MODDED LINE- [/B] goto :goto_0




    /com/htc/profileflag/TellHtcController.smali - disables auto reporting to HTC

    .method static constructor <clinit>()V
    Code:
        .locals 11
    
        const/16 v9, 0xc
    
        const/16 v6, -0x6b
    
       [B]original line[/B] const/4 v8, 0x1
    [B]modded line [/B] const/4 v8, 0x0
    Code:
        sget-object v5, Lcom/htc/profileflag/TellHtcController;->EnabledTellHtcDevice:[B
    
        aget-byte v5, v5, v3
    
        if-ne v5, v6, :cond_4
    
     [B]original line[/B] const/4 v0, 0x1
     [B]modded line[/B]  const/4 v0, 0x0

    .method public static isDisableErrorRport()Z
    Code:
        .locals 1
    
         [B]original line[/B] sget-boolean v0, Lcom/htc/profileflag/TellHtcController;->profile_force_disable_error_report:Z
        [B]modded line[/B]   const/4 v0, 0x1
    
        return v0
    .end method
    .method public static isDisableUlog()Z
    Code:
        .locals 1
    
       [B]original line[/B] sget-boolean v0, Lcom/htc/profileflag/TellHtcController;->profile_force_disable_ulog:Z
        [B]modded line[/B]   const/4 v0, 0x1
        return v0
    .end method

    .method public static isEnableAutoSend()Z
    Code:
        .locals 1
    
        [B]original line[/B] sget-boolean v0, Lcom/htc/profileflag/TellHtcController;->setting_enable_auto_send:Z
        [B]modded line[/B]   const/4 v0, 0x0
        return v0
    .end method



    /com/htc/profileflag/HtcBuildFlag.smali Tells framework it was built without CIQ support

    Code:
    .field public static final HtcCIQFlag:Z = true [B]change to false[/B]

    /com/android/internal/app/IHtcAppUsageStatsService$Stub.smali - Disables HTC app usagestats service

    .method public static asInterface(Landroid/os/IBinder;)Lcom/android/internal/app/IHtcAppUsageStatsService;
    Code:
    [B]replace WHOLE old method with just following[/B]
      .locals 1
    
        const/4 p0, 0x0
    
        return-object p0

    /com/android/internal/app/IUsageStats$Stub
    .method public static asInterface(Landroid/os/IBinder;)Lcom/android/internal/app/IUsageStats;
    Code:
    [B]replace WHOLE old method with just following[/B]
      .locals 1
    
        const/4 p0, 0x0
    
        return-object p0

    /android/provider/htcCheckin.smali htc/google checkin disable
    Code:
    [B]original[/B]
        sput-boolean v0, Landroid/provider/htcCheckin;->bCHECKIN:Z
        sput-boolean v0, Landroid/provider/htcCheckin;->bGOOGLE_CHECKIN:Z
    
    [B]modded[/B]
        sput-boolean v1, Landroid/provider/htcCheckin;->bCHECKIN:Z
        sput-boolean v1, Landroid/provider/htcCheckin;->bGOOGLE_CHECKIN:Z

    /android/net/http/htchttpiqagent.smali - IQ agent uploader (i think)
    Code:
    .field public static final CIQVersion:Ljava/lang/String; = "1.1.1" [B]change to "6.6.6" (anything > 3)[/B]
    .field static final enableCIQ:Z = true [B]change to false[/B]
    Code:
        .locals 8
    
    [B]original[/B]    const/4 v2, 0x1
    [B]modded[/B] const/4 v2, 0x0
    
        const-wide/16 v4, 0x0
    
        const/4 v3, 0x0
    
        const-string v7, "EVDO"
    
        const-string v6, "1.1.1" [B]anything > 3.0.0[/B]
    
        const-string v0, "1.1.1" [B]anything > 3.0.0[/B]
    
        const-string v0, "1.1.1" [B]anything > 3.0.0[/B]
    Code:
    .method public static getCIQFlag()Z
        .locals 1
    
    [B]original[/B]    const/4 v0, 0x1
    [B]modded[/B]  const/4 v0, 0x0
    
        return v0
    .end method

    /android/media/MediaCIQ
    .method public static enableCIQ(Ljava/lang/String;)Z
    Code:
        :cond_0
    [B]original line[/B]    const/4 v1, 0x1
    [B]modded line[/B]  const/4 v1, 0x0
    
        :goto_0
        return v1
    
        :cond_1
        const/4 v1, 0x0
    
        goto :goto_0

    /com/android/internal/telephony/SMSDispatcher.smali
    Code:
    .field public static final COMPILE_OPTION_CIQ_SUPPORT:Z = true [B]change to false[/B]
    59
    Code:
    [B]/system/app/MyReportAgent.apk[/B] - tell htc
    [B]/system/app/HtcLoggers.apk[/B] - writes to /data/data/com.htc.loggers/. Has a checksu function. [URL="http://xdaforums.com/showpost.php?p=17270348&postcount=44"]Analysis here[/URL]
    [B]/system/app/HTCIQAgent.apk[/B] - IQ agent app. Analysis [URL="http://xdaforums.com/showpost.php?p=17316913&postcount=61"]here[/URL]
    [B]/system/app/CheckinProvider.apk[/B] - HTC Checkin. [URL="http://xdaforums.com/showpost.php?p=17332445&postcount=73"]Analysis here[/URL]
    [B]/system/bin/htcipcd[/B] - HTC IPC server. [URL="http://xdaforums.com/showpost.php?p=17366102&postcount=94"]Analysis here[/URL]
    [B]/system/bin/iqfd[/B] - CIQ frontend daemon. [URL="http://xdaforums.com/showpost.php?p=17365547&postcount=93"]Analysis here  [/URL]
    [B]/system/bin/iqd[/B] - CIQ backend daemon. [URL="http://xdaforums.com/showpost.php?p=17365391&postcount=92"]Analysis here[/URL]
    [B]/system/bin/androidvncserver[/B] - VNC remote screen display
    [B]/system/bin/usbnet[/B] - config for local vnc
    [B]/system/lib/libciq_client.so[/B] - ciq client lib
    [B]/system/lib/libciq_htc.so[/B] - ciq lib
    [B]/system/lib/libhtciqagent.so[/B] - ciq agent lib
    [B]/system/etc/iqprofile.pro[/B] - has a url for [url]https://collector.iota.spcsdns.net:10003/collector/c[/url]
     
    GSM/OTHER ROMS(For now)
    [B]/system/app/RamdumpEnabler.apk"[/B]
    [B]/sys/lib/libhtc_ramdump.so[/B]
    [B]/system/app/NetLogger.apk[/B]
    [B]/sys/lib/libhtc_netlogger.so[/B] - writes to /data/data/com.htc.android.netlogger/.  Uses TCPDUMP!??!?!?!??!?!?! (SEE WIRESHARK)

    Build.prop
    Code:
    [B]ril.iq.quickboot=1[/B] - IQ start 
    
    # Disable checkin/profiling services
    ro.config.htc.nocheckin=1
    ro.config.nocheckin=1
    profiler.force_disable_err_rpt=1
    profiler.force_disable_ulog=1
    
    
    [B]ALL OF THESE MIGHT NOT NEED TO BE REMOVED[/B]
    id guess at crash/checkin being bad.  replace url with http://127.0.0.1  so you dont go to defaults.
    # For FOTA setting (leave empty value to use default)
    ro.htc.checkin.url = http://andchin.htc.com/android/checkin
    ro.htc.checkin.crashurl = http://andchin.htc.com/android/crash
    ro.htc.checkin.url_CN = http://andchin.htccomm.com.cn/android/checkin
    ro.htc.checkin.crashurl_CN = http://andchin.htccomm.com.cn/android/crash
    ro.htc.checkin.exmsg.url = http://fotamsg.htc.com/android/extra/
    ro.htc.checkin.exmsg.url_CN = http://fotamsg.htccomm.com.cn/android/extra/
    ro.htc.appupdate.url = http://apu-chin.htc.com/check-in/rws/and-app/update
    ro.htc.appupdate.url_CN = http://apu-chin.htccomm.com.cn/check-in/rws/and-app/update
    ro.htc.appupdate.exmsg.url = http://apu-msg.htc.com/extra-msg/rws/and-app/msg
    ro.htc.appupdate.exmsg.url_CN = http://apu-msg.htccomm.com.cn/extra-msg/rws/and-app/msg

    PLACES IN KERNEL/RAMDISK
    PLEASE HAVE YOUR KERNEL DEV DISABLE STUFF IN THIS POST - http://xdaforums.com/showpost.php?p=17327620&postcount=68

    In ramdisk remove the following
    Code:
    #for CIQ ipc
    mkdir /app-cache/ciq 0711 root system
    mkdir /app-cache/ciq/socket 0777 root system
    
    # HTC IPC server
    service htcipcd /system/bin/htcipcd
        user root
        group root system
    
    # CIQ backend daemon
    service iqd /system/bin/iqd
        user root
        group root system
    
    # CIQ frontend daemon
    service iqfd /system/bin/iqfd
        user root
        group root system
    
    
    service htc_ebdlogd /system/bin/htc_ebdlogd -s -k -P 7
        user root
        disabled
        oneshot
        ioprio idle 0
    
    service htc_ebdlogd_rel /system/bin/htc_ebdlogd -s -k
        user root
        disabled
        oneshot
        ioprio idle 0
    
    
    on property:ril.iq.quickboot=1
        start iqfd
        start iqd
    
    
    # for vnc
    service androidvncserver /system/bin/androidvncserver -a
        disabled
        oneshot
    
    service usbnet /system/bin/usbnet on
        disabled
        oneshot

    While your in ramdisk, you will want to change default.prop. Here we can hide our bootloader and unlock state from being reported to htc/sprint/google/whoever else. See - http://xdaforums.com/showpost.php?p=18754843&postcount=279 The following two should be set in default.prop:
    Code:
    ro.lb=unknown
    ro.bootloader=unknown

    DIRECTORIES/ FILES USED:
    After making all above changes, remove anything in the below directories than reboot. Make sure nothing new is being added

    Code:
    /data/anr/
    /data/data/com.android.htcprofile/
    /cache/recovery/
    /data/wimax/log/
    /devlog
    /data/system/usagestats
    /data/system/appusagestats
    /data/system/dropbox
    /data/system/userbehavior.db
    /data/system/userbehavior.xml
    /app-cache/ciq/
    /app-cache/iqserver
    /data/misc/agent_htc/
    /data/data/com.htc.loggers/

    For safety you can chmod 400 or 000. Doing this alone without above framework changes will result in errors on write

    How to tell Services running on phone
    Code:
    adb reboot
    adb shell
    logcat | grep Service

    also make sure you dont see iq stuff here
    Code:
    adb shell
    getprop | grep svc
    58

    /com/android/server/ulog:
    Utils.smali-

    .method static isTellHtcEnableAutoSend(Landroid/content/Context;)Z
    Code:
        .locals 4
    
    [B]original:[/B]    const/4 v3, 0x1
    [B]modded:[/B]    const/4 v3, 0x0

    .method static isUserProfilingSettingEnabled(Landroid/content/Context;)Z
    Code:
        .locals 4
    
    [B]original:[/B]    const/4 v3, 0x1
    [B]modded:[/B]    const/4 v3, 0x0



    UserBehaviorLoggingService.Smali
    Code:
    [B]original:[/B]    const/4 v0, 0x1
    [B]modded:[/B]  const/4 v0, 0x0
        iput-boolean v0, p0, Lcom/android/server/ulog/UserBehaviorLoggingService;->mEnableHTCUBLog:Z

    PolicyStore$DefaultPolicyLoader.smali- Defaults for database on what to log.

    There are 10000s of changes I made, just search for "1" and change to "0" (for the most part) These are the trigger actions

    There are also 2 IPs, change to 127.0.0.1
    Code:
        const-string v2, "policy"
    
        const-string v3, "url"
    
        const-string v5, "175.41.155.212:2021"
    Code:
        const-string v2, "log"
    
        const-string v3, "url"
    
        const-string v5, "175.41.164.137:8000"

    /com/android/server/ServerThread.smali- Dropbox/Userbehavior Disable
    Code:
        invoke-direct {v9, v6, v10}, Lcom/android/server/DropBoxManagerService;-><init>(Landroid/content/Context;Ljava/io/File;)V
    
    [B]original:[/B] invoke-static {v5, v9}, Landroid/os/ServiceManager;->addService(Ljava/lang/String;Landroid/os/IBinder;)V
    [B]modded:[/B]     invoke-static {v5, v9}, Landroid/os/ServiceManager;->deleteService(Ljava/lang/String;Landroid/os/IBinder;)V
    Code:
        invoke-direct {v9, v6}, Lcom/android/server/ulog/UserBehaviorLoggingService;-><init>(Landroid/content/Context;)V
    
    [B]original:[/B]    invoke-static {v5, v9}, Landroid/os/ServiceManager;->addService(Ljava/lang/String;Landroid/os/IBinder;)V
     [B]Modded:[/B]      invoke-static {v5, v9}, Landroid/os/ServiceManager;->deleteService(Ljava/lang/String;Landroid/os/IBinder;)V


    /com/android/server/am/HtcAppUsageStatsService.smali - this is the dreaded HTC logging that has no off switch. This is the only way I could disable by replacing full methods with nulls.
    Code:
    [B]remove all old junk and make these methods look exactly like this:[/B]
    .method public notePackageRemoved(Ljava/lang/String;Ljava/lang/String;)V
        .locals 0
    
        return-void
    .end method
    
    .method public notePauseActivity(ILjava/lang/String;)V
        .locals 0
    
        return-void
    .end method
    
    .method public noteRecentTaskChange(Lcom/android/server/am/TaskRecord;)V
        .locals 0
    
        return-void
    .end method
    
    .method public noteResumeActivity(ILjava/lang/String;ZZ)V
        .locals 1
    
        return-void
    .end method
    
    .method public noteResumeActivity_pkg(ILjava/lang/String;Ljava/lang/String;ZZ)V
        .locals 1
    
        return-void
    .end method
    
    .method public publish(Landroid/content/Context;)V
        .locals 0
    
        return-void
    .end method


    .method public registerAppLaunchObserver(Lcom/android/internal/os/IHtcAppLaunchObserver;)V
    Code:
        .locals 5
        .annotation system Ldalvik/annotation/Throws;
            value = {
                Landroid/os/RemoteException;
            }
        .end annotation
    
    [B]original line:[/B]     if-nez p1, :cond_0
    [B]modded line:[/B] if-eqz p1, :cond_0